Data Breach Report Submission Form

<ul class="progress-indicator"> <li class="active"> Introduction</li> <li> Reporting Entity Information</li> <li> Contact Information</li> <li> Breach Details</li> <li> Attachments</li> <li> Review</li> </ul> <div class="error-summary"></div>

Is this an initial report or an update or revision to a prior report?

Initial ReportUpdate or Revision to Prior Report

Please send an email to ag.breach@ct.gov to provide your update and include the reporting entity’s name and your case number in the subject line. If there are any follow-up questions or concerns, a staff member with the Office of the Attorney General’s Privacy and Data Security Section will contact you.

<ul class="progress-indicator"> <li class="completed"> Introduction</li> <li class="active"> Reporting Entity Information</li> <li> Contact Information</li> <li> Breach Details</li> <li> Attachments</li> <li> Review</li> </ul> <div class="error-summary"></div>

Reporting Entity's Information

Entity Name Entity Street Address Entity City/Town Entity State/Territory Entity Zip/Postal Code Entity Industry or Line of Business Organization Size (Based on # of Employees) BackNext

<ul class="progress-indicator"> <li class="completed"> Introduction</li> <li class="completed"> Reporting Entity Information</li> <li class="active"> Contact Information</li> <li> Breach Details</li> <li> Attachments</li> <li> Review</li> </ul> <div class="error-summary"></div>

Your Information / Point of Contact’s Information

First Name Last Name Title Firm/Organization Street Address City/Town State/Territory Zip/Postal Code E-mail Address E-mail Address Confirm Phone Number BackNext

<ul class="progress-indicator"> <li class="completed"> Introduction</li> <li class="completed"> Reporting Entity Information</li> <li class="completed"> Contact Information</li> <li class="active"> Breach Details</li> <li> Attachments</li> <li> Review</li> </ul> <div class="error-summary"></div>

Breach Details

Did the Breach Occur at a Third Party? Yes No

Third-Party’s Information (Complete if You Selected “Yes” Above)

Third-Party Name Third-Party State/Territory Industry or Line of Business Relationship to Reporting Entity Date Third-Party Notified Reporting Entity of the Breach

Type of Breach (Select All That Apply)

Systems Breach – Phishing/Email Compromise Systems Breach – Ransomware Systems Breach – Credential Compromise External Systems Breach – Other Inadvertent Disclosure (e.g. misdirected email) Employee Misuse or Insider Wrongdoing Loss or Theft of Device, Documentation or Media Other Breach (Describe Below) Description of Breach (2,000 characters max.)

Information Involved (Select All That Apply):

Social Security Number Individual Taxpayer Identification Number (ITIN) Identity Protection Personal Identification Number (IP PIN) Driver’s License Number / Non-Driver ID Passport Number Credit and/or Debit Card Number Financial Account Number & Security Code / Password Medical Information Health Insurance Information Biometric Information Username / E-mail Address & Password Other Other Information (Describe Below) Is the Reporting Entity required to provide notification pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)? Yes No Is the Reporting Entity providing notice pursuant to a state contract? Yes No If yes, please provide details on the contract to include the contracting agency. Total Affected Individuals Including Connecticut Residents (Number Only) Total Affected Connecticut Residents (Number Only)

Dates Related to Breach:

Date Systems were Initially Compromised (If unknown, provide best estimate and describe in additional comments) Date Systems were Remediated Date Security Incident Discovered Date Personal Information of CT Residents Discovered to be Involved Date of Consumer Notification Was notification delayed at the request of law enforcement? Yes No

Method of Notification to Affected Individuals (Select All That Apply):

Written Electronic Telephone Substitute Notice Are identity theft protection services (such as credit monitoring) being offered to affected individuals? Yes No Name of identity theft protection provider and name of product or service. Duration of identity theft protection service in months (Number Only). Note that this number must match the consumer notification template.

*Note that if Social Security Numbers were compromised in the Breach, Connecticut law requires appropriate identity theft protection services be provided to affected Connecticut residents for a minimum of twenty-four (24) months.

Select and Describe All Actions Taken in Response to Breach:

Changed / strengthened passwords Implemented multi-factor authentication Implemented new technical safeguards Improved physical security Revised policies and procedures Trained or retrained workforce members Sanctioned workforce members Other Actions (Describe Below) Other Actions Taken in Response to Breach: Additional Comments: BackNext

<ul class="progress-indicator"> <li class="completed"> Introduction</li> <li class="completed"> Reporting Entity Information</li> <li class="completed"> Contact Information</li> <li class="completed"> Breach Details</li> <li class="active"> Attachments</li> <li> Review</li> </ul> <div class="error-summary"></div>

Attachments

- You may upload up to 3 files, and each file size is limited to 10 MB.

- The preferred file type is .pdf, but .docx, .doc, and .txt. are acceptable.

- An error will display if a file name contains any of the following invalid special characters: { } % < > ! @ # $ ^ * ; " ~ + | ?

- If you need to upload an image, the preferred image file type is .jpg or .jpeg, but .tiff, .png, and .bmp are acceptable.

- Please upload a template copy of the notice to impacted Connecticut residents under “Template Consumer Notification (Required)”. If you have more than one template notice, please combine and upload them as a single file.

- You may upload a cover letter under “Cover Letter (Optional)” and any additional supporting documentation you wish to include under “Other (Optional)”.

- Please do not include any identifying consumer personal information.

Template Consumer Notification (Required) Cover Letter (Optional) Other (Optional) File1 File2 File3 Sequence ID Date Entered BackReview

<ul class="progress-indicator"> <li class="completed"> Introduction</li> <li class="completed"> Reporting Entity Information</li> <li class="completed"> Contact Information</li> <li class="completed"> Breach Details</li> <li class="completed"> Attachments</li> <li class="active"> Review</li> </ul> <div class="error-summary"></div>

Review

Back